WC_REST_Authentication::is_resolved_route_in_scope │ private │ WC 11.1.0

Check that the route WordPress resolved is one an API key may authenticate.

Method of the class: WC_REST_Authentication{}

No Hooks.

Returns

bool. False only when the resolved route is not ours and the request URI never named it.

Usage

// private - for code of main (parent) class only
$result = $this->is_resolved_route_in_scope();

Changelog

WC_REST_Authentication::is_resolved_route_in_scope() WC REST Authentication::is resolved route in scope code ^{WC 11.1.2}

private function is_resolved_route_in_scope() {
	// Has WordPress picked a route yet? If not, there is nothing to compare.
	$resolved_route = $this->resolved_route();

	if ( null === $resolved_route ) {
		return true;
	}

	// Our own namespaces are always in scope for a WooCommerce key. The read/write permission
	// check in check_user_permissions() still bounds what the key can do there.
	if ( $this->is_wc_namespace( $resolved_route ) ) {
		return true;
	}

	/*
	 * Any other namespace is in scope only when the request URI named this exact route.
	 * WP::parse_request() can take rest_route from more than one place, so the dispatched route is
	 * not necessarily the one woocommerce_rest_is_request_to_rest_api approved. WordPress also
	 * decodes rest_route through parse_str() while the URI route is read raw, so the decoded form
	 * names the same route.
	 */
	$uri_route     = $this->route_from_request_uri();
	$decoded_route = trim( urldecode( $uri_route ), '/' );

	return $resolved_route === $uri_route || $resolved_route === $decoded_route;
}